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Abstract 

The toeicosaectlfla of local area networks it tecressingry important, bat Unit dm ere evettabU oa &» 
chzracbsiancs of the eggregata traffic tfatt LANs will be submitting to me int&fcan&ftcdon media. Ia order to 
understand the Utferecuon* between LAN* end the proposed iDtacanacetion networks (MANi, WANs, to4 BISDN 
oetwarkaX it it necesuiy to study the bshwior of this «W«m/ LAN traffic over many tim» scales - ton 
rafllianoondi to hundreds of second*. Wo preset a high tfanc^ttotato hirdwire monitor tor Ethernet LAN* mat 
avoid* the shoncomiogi of prevtow monitoring tools, tuch u traffic burst clipping end ameslamp jitter. Using dote 
recorded by our monitor »r several hundrod million Ethernet packets, we preaeni an overview of the short-range 
time correlations in external LAM traffic Our snah/rii showi that LAN tzaffio if extremely bursty across time 
Awwoifwi snsjming six orders of Wo compere da* behavior with simple formal traffic models tnd 

employ the data fan • trace-driven iVi^Kmi 0 f LAN-B1SDN tnlerfice proposed for to SrfDS 8 * service. Our 
results suggest mat the pronounced short-term traffic correlations, together with the extensive time regime of traffic 

bUfOtfaWtrff. Strongly ft* th* pf™*-* tr»w mnA 4Ay fnAicud by LAN fartemfffmrrtifln. 



As the mtenonaeotlen of local srea network* becomes increasingly fcnponsaf, anderstsndlqg the mtm c to 
between LAN traffic end larger area QtfAH WAN, end BI8DN) aerworJcs becomes ever mam crtxlcsl. Because the 
detailed behavior of LAN traffic greatly hdmesoes bom me performance sad die deafen of potential LAN 
inmrccm»cttonscbeiixs > we 

scales: fitmooffiseamda to days. Uofcrtutttt^, exUo^ toob 
ahontmieacal^ and exii^ approach 

4ifnarexetmtt daroaizu. In mi* paper; we describe s novel hardware monitor for Ethernet* traffic, chs ri c Ttri ro Its 
accuracy, and present some analysis pexspecuves for tmderitanding and characterizing the rea afrtng traffio 
mes*urcments. We tn*n illustrate the lamortaaoe of rssllsdo traffio charactErizaaoQ with en example drawn from a 
tomulsaonstno^of toopaii* effects induced by one LAN-u>BISDN access proposal 

Although there have been many sttdiei of LAN traffic since the early Brhemrt measurements of Shooh end Hupp, 115 
the emphasi I has beta en mtexmsdiats tixne scale behavior 01 ^ w or on user-oriented measures of behavior neb as 
LAN throo gbpul and daisy* 13 1*1 More seriously for our study, Uok published data sre available on the packet feu 
and f~T*-i*fr errors totrodueed by me data collection techniques canployed. The early studies rypteaDy u»cd Urns 
nieosuremcnts with Sow resolution (oa me order of one sscond), with high loss rates (as much ss 5tt to 9Hof sll 
packets). Recent studies, such ei Feldxneier^, GaseUaPJ, and Jam and RoutHcr^ 1 , have made higher time. 
resolution measurements, but hare relied oa operating system tnorfffirwrinns to handle tmteatamplng, with a 
resulting lose of tuning accuracy and clipping of traffic peaks: the systems reported soil losa between 1% and 5% of 



£MDS U a asrvtee rag* ofBSUconi 

lihAajo^«fBdlooiBiB«»o*d«ayitateBta»gf«o«s^^ ^awmlwofpfoeooooi 
vatdnsi ta Bis paper a does wbefv Desesniy aw tb$ nks of nfanlfic accBiny nd ptm&Stn* ot Sv badepvuse hubonfttioa to a posit of 
t^aofaoy sdiM^oi n afovlde m eusqb 

ww^m!i£mw*tovnA**<***<M*tat. Klifttr ew tachnlos of t prodort et • vesaor la eui p^, n« c« oad^oe of • 
B&cr^tSSTm^Ae^tmla^ofXraCetpenflM. 
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the LAN p«ck«sL May of then ftndfctt moreover, bm employed eyorfgenai caafiggBtem flat attfrefr 

SEhowever. to enter to teame* •J^^^j^^^^^^^SSr^ 
K^a^ofpeetesbeecmpl^lyeapto^ 

PttvtoM outlet of IAN woffle hove wo other nstrbtloa* thai ffiike to l|» weO to wrfjatodbg 0» 
S^^tnteroo^oatheyha^g^^ 

S^^^^rfult^ totodon). «d (hey hro oftea u»d extreme* «m*«T^e 

tH»r^^werertU8*» 

.aaroe usd oarineiien fidda, in onto to dirtngulih purely locel traffic from oumriinSx. (4« ti, pecime 
uigpiating ob one LAN tat uWmuely mmMt^U^ IM^^^m^^V 

vJSwTover ell time ecdc*, eo dlsmgulihing Umpomry eberrtttei ^J^_^ kaV1 ^*' ^ 
eM^iniilLcIt^epacedsemjitopedo*^ 

observed tnfflo tbM psrein eereM time, and cm Ohmtaiie»etneof<tap»n^ni»ofvBj™tion, 
Our ewer first dwafbos our berdwere Ethernet moaner, trim Ite cW^a. ttamg, and peAnoeace. Soetton 3 
daK^»me enmlyii. technic « h»v e feund epproprUte to uod-ttmHag d«t» traffic ^^J^ 
doMina, with illMMnon* ihra. from cur raalyiU of ma exclave 

Sec&m 4 eW «pbi» tb« ta» end delay effects or cm pc^ BODN «vfce fcr faMeonnectog 
CM iwuto *«= wfflc d»» wUfathoia o«xfc*d few •lmfle formal 

Section 5 briefly summarizes mriaulu. 

X lANTMkMoaftariet 

U Approach** to LAN monttertag 

Ttet ere two major anmercho. to monttoxfag LAN* **npea* ***. j^^f^ 

fee monitor look* of each packet u U come* m and take* tome acttoa detemmed ^*f 01 ^* 

^XSal^thnecett reduction. Moateommete»alI^eMdy*ei.«dleomo^ 

exSvTdS «W» Poteoael oTrrtofpeebV. todmiqua with unseat thr«*hput etped&r » «*ely 

picfcrt <eca on the network under cwninttion . 
X3 Dftl|9 ?f tb* wonltor 

w£ cm*«rd LANCE Bhern* mter&ce. a SmvJ ^notation with ^ ***** drb«, ^ » "j^" 
cmscttv Bom haHce! wen distal tape drivel. T^^»ba^aia^(^^t»ptiii^mtU^^^ 
Wa^TSs^S^Aaa wfah ea Interval timer b^ Fi^ .how. me tfructure of the 

Figure 12.1: Block Dlapwn of Monitor 
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3£p££J I*n P«»» » to Sun wtettto wUch ton oop* to bnfi*to . **fll^^r 

SStottS iBOwbtol^pocU to dau to taa tape. Bach sago* c«tnontoi 

{SwtaJttw - toRAM on to SBC bufieo *ta bound fe to tower *»*^^^£^ b,, *£ 

KSwa urn tandwU* tarn ape drive, Byubg to BBC,*. « abb £ 

S^c^oeoMr to .Bvidag to Etomtt interface chip. ^ "l 1055 ^^ » f / e ^^£ 

i^ZTotoi^Bitodw Wet»al>to»CM8*ltaaUp^e I .r«c«o^^ 

pmctOft f Itt4 «taMh« hiainiHca] buffering. 

A typical day-Vms owe ftwn » ftiriy herril, loaded wKroik Cwugnly 20H ivmge niiliMlon tvaified over a 
d^Tto,)5»Sr2 gig^of^oi daa.fiffi^on. 8mm tape. Wontttofrnake noes »wk mlenglhof 
0TBr too million packets wfflt no loss of data. 

U Me asuri n g the Mcaaartr 

In dauemne * noniur to molding IAN packets, one hope* to design ■ fyitcn tot can capture evwy padaet at 
^^t^tSosStoni accK? O-r^Sn doe, a b 
5ta«tnet^ Tbii section of 

to paper xrta«iian>e*aiB6tBil» to bdwviorof to moiBteuntat^togWwWertloaA 

Tto to-meptatona by which to ^,"^^^^^^5 
n^ni*baablaloga«toinfliwy«ufl^^ 

able to «upply buSta to to LANCE Cut enough ewa tons* htitoa»*vnilabW;endtoren^bot*buaBi 
available to give to to LANCE, 

W. wiod to ayoan by using • bad geacwor » sun* . porfoto rtieomof f^P^J^^S 
^axcennmbii, allowing iu to modaely detemto wla^ iwkea wen '^J^™" 
^HiM^to dbar^ire to leu behavior of to monitor la to coarider to ^ ^ 
taeorood without cuor. At to KgheatpoaalrteBtoniatBtt. of 14.400 V^jr^f^^flt^^^ 
ofabnntewirptaadwitoutlois. Firm rTgwe 2.3.1, we see tttoulhepastotii^ ^ 
to con b, aiptawl wiftoia Ion grows. Tho uldmale EmlWiai to to very loag tim p*ek« rw tot cznt* 
e.^UtotoWttoftoctodigiDJtti^ In ft. cunent ImpU nr n t . Hnn , about 2J0Q packet* par aocond 
may he captured without loss for as long 61 blank tipej ere provided. 

Figure u.l; BWftloog&araconfadwiQKmllon 
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w»iltocxMtodtto«aii«yofC»ttewa«p fc W, toad ^T^^f^^ni^»^^ 

^cfaT^ece^^ i l!?* , L^J^-?S^22 
Cro»«a**'»te««»« te » a » <tal » t9,,,ak - ™" ««* - «««■?> *J££&?£1 
second, tho thnmajnja are «m accaals to within ICO rataojeeoadj: really two ariezi of magnitude better tfctn 

ether leBg4sm atodiaa. 

lib*^notii«thjtfthep^r»te*wee*uiing^ 

any of *e pathological on nted fa sows taring the system. 

j. cbanetafaatam af ajitalBtfantor 
The IJWt^atODilur just dnse^ 

coBfemet etblM tooaribl. «itha BeOeote'i Mom. Raaseroh and Bf-cn^g <^*^» Jg 

ftRraHsLry W0. to thtowrtfan. w. observed «ril^he»avlorrf 

SLSon to <he wide rtnfit »f *=e domain. «* »" - 

»*^TlflJ44MUt/wc^ 
L^fhcBttat dtoedy wppiyma ***** 
^^totfaitroutcr. Atteftitt^w.gad^ 

whom bsd a Sua-4*, or DECrtatloa* 3100 woiksttfion co thair dsik. It *» TO <*» ilt«va»«d* 

Figure 3.1.1 ! Ftfiket tfftv%l nta vi time of day 
^tnalttwfttanlH^, 10Octtol0:19,a3<>»l»»9 
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TbtirioelramlHarcharacTejizatt^ 

bytce or pacta* ■«» tna aottuud, toMlr» « «*r- Hm-rfwfcr l97P-«tadr e- fc 9« ia o g > M » f m o an J Prtn i«l by- 

Shoci Hin^ reported eeeiz^ 

network capacity, wbh 4 pronounced dxurail cycle. The duooal cycle li readily apparent In cur cuzxent 
' measromeatB of aggregate traffic, both for internal tnd external traffic (at flhwtrated to external traffic in Figure 
3.1,1), but the value of "lea than Itt utilization" U no longer reeliitic, even given (be higher lO^tagebyte per 
gyr^rfl Eflaroet epeedf now In use: to rnmrnal craffic, mega inonihry ptfllzarfoa exceeded 153^ whfr d^-fly peak 
ym^ly rTTf^lng ntiHnriim tm wriafaya and oeak mfamtea exoofdm a 50K> (OarinteixxalEttienists 
each cany about half ae many packets u an average link in the cunest national Internet backbone* 105 : en the order 
of W ndUien pa fkp tff a day; It if taerwting dial tms tsdo wa* alao true In Sbocb and Bupp'i nudy, deapits &o cider 
of magnitadfl increeee in absolute load over me past decade.) 

The aggregate external trifle from all of Bellcore ii typically W to 1% of (he volume of traffic aeen cm a fairly 
bcavtty loaded internal Ethernet cable. Thus, (be mean daily ntiUratwn of (ha Ethernet dnd god be attributed to 
external traffic b now in the 1% range cbirar^atfn of all internal traffic in 1979. The peak utilization* observed 
over snorter timea fox externa] traffic alao doeery match me 1979 internal ttaffio peak* to example, toe peek 
external minute in October. 19«, represented en Baere* wl^^ 

peak minute of 16%. Thia conipari^ eoggcati toadneat characteristics described below may wll have 

been true in 1979 aa well tl ia our 1989 study, unfortunately, me analysis techniques described below are not 
available for (be 1979 report One ahoiu^nce^inoiec^, that pea^ 
b7 fbe 1 ^M-triegalal per geeond extend 
OT etue*»13.4^toperiodaulo^ 

$a "Bareness" 

For purpose* of modeling die demai^ 

art highly bursty over a wry wide mgo of time scales* Figure 3iU display* the mem packet airivd rates over 
each ltoor to a rnoirn^ period of 307 ooveeuo^ 

mfft fa fin*r-«*»^ rfitrt^y «f&t> p«k mbintcrval from tfala period (Figaro 3JUb), which preagnu the arrival ratea 
uattcceaarve onecilnirte mtervab 

vaiying arrival lewiaetrfcm* IctonjaUy # c«ema^ mat mere iii»m 

cleieTexaininetioo above mat a "fcwy period" eenaiets of a few ••very Voiy" aabperioda eepanted by 
compaiasively •'alow" intervals. 



Figure 32.1a: Hourly acrval reto of cateroal traffic 
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Figure 3Xlb: Arrival titea by annate, bgpeat6 tow 
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riccc tote muted it 1437. 10 Oct 19«9 



This behavior ia actual traffic creates for many cosnsxios&l meaeurea of "bUBdneu". Throe 

ccmmcnrynB^ definitions « 

mdax of dispersion. >u Figure 3 J.2 iiluetrelns, u^ obser^ 

mtarv&l over which the taxoVidtfa is detenrnned. For this pntxaUr two^week sample of external traffic, the peak 
rtttt in bytes per mood observed ta any 3 weend interval is 132 times the mom etrfvaJ ™te, whilo the peak rata 
observed in toy 5 rnffliaecend tnteivsi Is 715 times (he mean. The disparity m peaie-tonean rstioe is even hlgfrer 
when tmctot Efrirtl niftf if* r-W^FH 1 , TTfTjnH * ™ «" g * 1 t» 5wnH1ftfnw^ Intervals fa this 



Figure 34.2; Peek to mesa nolo for email traffic 
otcTCTl tace flea Ud7. 10 Oct to 10: 1 9, 23 Oct 1989 




0.03 (XI 0J^ 
taerval to seconds 



Thf T ffrf Brffnt ttf ""rirtfrft *rrwf ^^p*^" "»y rfther fer icterimval times or faratrivslsP 1 ^ 

In the limiting case of extremely long measurement parted*, the two definitions present the same infirrmetion; hero 
wa shaD concentrates the arrival values. lire coefficient of variant for arrivals m a given tin^ 
L is the redo of the standard deviation b the observed number of arrivals in a time interval of length L to the 
observed tnesa number of asivabm that tiino interval. Figure 3 JJ compare* me observed coefficient of vwUUon 
for arrivals for thi utcrae! traffic of our raining example wimthe eoefBeient of variation mr a Foisscn arrival 
process with a mean arrival rats of 100 pockets per second. Jntuftrety, one may say that simple, enarytieelry 
tractable models (such as a PoUaon, batch FoUecn, hyperexponennel or Merkov^cduleted Foisson process) have 
very little long-range vamHlity: the cooffieieni of vriarion for annals rapidly converges to aero outside the 
characteristic time domain of tfio modal. In sharp contrast, the observed traffic has biirstbess at all time scales 
throughout the regime from milliseconds to mousands of seconds. 

Recently, leverel researchers TO OH n«l fcjve proposed adapting formal models to observed ' •bmatlness" behavior 
by «»j i iiiyfa»g the index of dispersion. This measure ia closely related to me co effi cie nt of variation, and is 
commonly used to explore the effects of deferent tune scales on estimates of burstittce*. For a given time interval 
of lengm U the huln of b^peralM 

by the mean number of arrivals m an interval of le&gm 1. Figure 3.2.4 shows the index of o^persion for both 
internal and external traffic over me month of October; 1989. It Is particularly noteworthy that the index of 
dispersion snows cxtreinn^ 
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Figure 3.23; Coefficient of vnalion (orivali) 
otttnal nee ftam 143T, 10 Ort to 10:19, 23 Oct I W 



or 

VtfftttOB 




tmerr«: length L fa nsaodi 

J^eVtodcT of dtottoti *?»> to one; (he eta r^dly «^^^ 1 ^1^flSS 

more complex nodeta oonttructad ten Moon distribmkmi. woo ts h yywi pu ic Dtifll ^apd MOT* (MttfcwN 

.cXoHwlrtcr anrTtta* canaan* of the raoceU. Tb* let* ov of moiuttmlcaUy ^^^^ 

and^Whittt 0 *, or Heflct a4Lwnso&l W § may sot ctantctcrise the oconl traffic bsbeviflr well PtT the ttoge of 
significant time icslea. 



figure 3A4: Imfe* of dUptaton (nrivals) 
^iftom 107, 10 Oct to 10:19, 23 Oct 1W 
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For wny tatenctteu keama LAN» eat LAN-fatawxaaerioa sew* t)» critical tta« «mrtn» « ito to 
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pjotoooJ implemefflett^ ^ ***** widening of each peek 

«apUc«lry inuftnltt to er^ 

pt 7^ ff^^U Rc; Aft «f «*A peak (which ii limited bv to minimal parade tanet fa tending guoQMBhre 
packets) U more sharply defined min to trailing edge (which ia ipriad cm by itatiwical variations). Ibe implied 
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of Actual IAN Traffic oa LAN lour eauacdm 

Thr i^a-ht m* <*>«^*»«" fa meaimd LAN traffic, aa ffluttrated ift Aa greviona econon, atgrdtonoy *ffi*t&B 

loo and o^ctoactuiatiea chat wffl be eea when external LAN traffic If admitted to the aooea potofa of 

™oaedwtde^IANtat^^ TWiwIirallhiwtei^^^ 

lou end delay behavior imposed by one pzooosal for traffic Shaping (wasting aad rata lnnttettaru) « me 

jnterooonactitin a ooca e point. 

WeshaUtdwuowjoairipUtto 

TOa aropoeed service appears wefl-Kdted for providing wfe^roa io tcroa nacc doa of lANa, provided met 
rigpifiaitflrgTli irf snttf itfrrl ituffr! **"g .Ato-d Mogtfable delay aod loaa batota. SMPS aoryfcc 
is «rlaion«l as offering eoimectiooleiB pacta deli«* through bter&eea that split va^a iangOi pad^to 
fc^izacalleOe^proO^ 

itructure of the cells Is largely fanmaterlal to the dla&ta (neb at LANs) ostog fhia service, the t raffic a hapfag 
imoosed by me network mtcrftee Sa aigwfloaiiL Packets txtMng fton a LAN arc buffered at fce 80,1 

wdflxcnutaiDodh^face. pacta thai tone* entirely ttw^ 
Aet partial ptcbrti arr m»t tTr»*™'»^ A wide varies of eeryiwdaasee arc possibku^ 
oar exb^ traffic wucoll^ 
to eeclloa explores the cflto of eii^^ 
At this lev* 1 of smif f , tir wflWdvti flmnighpiri available to fee client la 1.173 MbitaWmd, 

The eamznt of buffeiina pnMded at fto Interface itroogfy effecte the total packet dehry and Ion obeerved^ the 
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aodfa9Spercomeft^ Siinpto ana^ oodrfa 

baatdoaowobeer^oxto^ traffic e^ 

between delay aad loaa, bowovtt, to earetneJy sent* ve to baratiziata to dio to^ Jl^^^^Sr^ rJ2£ 
traffic, (he authors twoto a tro^oMva dsoreovow 

totetfeoe buflar lor ayodudo and aomal traffic, la the figures below, the euros labeled 1 'external 
eimulrioo results derived otisg the catixo 307-hcw external traffic tiaca of pravloixi aectioMj the nnwUto** 
• 4 Poteca« and "batch Mawm" lepreseat, respectively. * pure Poiam arrival pxocaas of S9Myto packets (the 
mean length of the observed external traffic packets) and a batch PoUsoa ptoceee wifh *"Ue^ bair^ ft 
1024-byte ptckatt arriving catcnxloiatany within each batch at 2«xflliaacamd Intervals (baitattag packet-train 
characteristics suggested by the Palm diatribution aeec to Figure 3.4.1). 

THe .election of apprc^ arrival rate parameter* ibr the fennal models La ^^^"^Si! 
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paekax lose rata matchef the eaeaa packet loaa rate obtained to exwnaltraf^ 
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